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IN THE SPECIFICATION: 

Please amend the paragraph spanning lines 4-12 on page 2, as follows: 

Fig. la is a process flow diagiam which illustrates the steps associated with a 
method of combating viruses, A process 100 begins at step 102 in which a system, e.g., a 
computing system, operates. During the operation of the system » a determination is made 
in step 104 as to whether a virus has been detected within the system. In other words, it 
is determined if a virus has breached the security of the system. If it is determined that a 
virus is detected within the system, then drivers and/or dats are downloaded and applied 
from an anti-virus website in steps 106 and 108. If it is determined that a virus is not 
detected vrithin the system, then a determination is made in step 1 1 0 as to whether a 
specified time length has elapsed. The specified time length is a duration of time which 
passes before drivers and/or dats on the system are updated, e.g., by dovmloading current 
drivers and/or dats onto the system. 

Please amend the paragraph spanning lines 14-20 on page 2, as follows: 

If it is determined that the specified time length has not elapsed, then the system 
continues to operate at step 102. Ahcmatively, if it is determined that the specified time 
length has elapsed, then drivers and/or dats are downloaded and applied from an anti- 
virus website in steps 112 and 114 . Typically, all new and updated drivers and/or dats 
are dovmloaded. Once the drivers and/or dats are downloaded, the dowTnloaded drivers 
and/or dats are applied, e.g., by anti-virus software that is local to the system, the system 
continues to operate at step 102. 

Please amend the paragraph spanning lines 10-29 on page 16, as follows: 

After the virus type is characterized in step 402, a determination is made 
regarding whether an infection by a virus or viruses of the same type as the virus being 
characterized, or the characterized virus type, was prolonged. See step 404. For example. 
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if the current virus that is being characterized is a mass mailer type virus, then it is 
determined whether an infection caused by both the current virus and previous mass 
mailer type viruses is prolonged. Such a determination is generally made by studying the 
database in which virus profiles are stored to identify the date and the time of the first 
instfuice of the characterized virus tyjie within the overall system, as well as the date and 
the time of the last instance of the characterized virus type within the overall system. The 
last instance of the characterized virus type is typically the instance of the current virus. 
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